CVE-2001-1407: Bugzilla before 2.14 allows Bugzilla users to bypass group security checks by marking a bug as the duplicat...

Security readout for executives and security teams

This flaw let a Bugzilla user gain visibility into a restricted bug by using the duplicate-bug workflow. The business risk is unauthorized disclosure of sensitive issue data, such as security reports or private customer defects. The source bundle does not provide a CVSS score or active exploitation evidence. Exposure is likely limited to organizations still running Bugzilla before 2.14, particularly instances with multiple user groups, restricted bugs, and accounts held by semi-trusted or external users. Treat this as a targeted confidentiality issue for legacy Bugzilla deployments. Prioritize remediation if restricted bugs contain security vulnerabilities, customer data, or sensitive engineering information. Mitigation focus: Upgrade Bugzilla to 2.14 or later, or apply vendor-fixed packages.; Review the Red Hat advisory if using affected Red Hat-distributed Bugzilla packages.; Restrict who can mark bugs as duplicates until remediation is complete..

Prepared

Jun 30, 2026, 16:08 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.